CVE-2018-13878

An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned using the @ symbol in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every...

PT-2018-12246

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 0.65 Description A security issue was found in Rocket.Chat where the real name of a username is displayed unescaped when a user is mentioned in a channel or private chat. This allows for the exfiltration of the...

CVE-2018-13878: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned using the @ symbol in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every...